- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- SHA256
f24237f81ca6e2c09ede489119e64cd2a18f0b6c269971990a223f2f2dc00ff7- SHA1
7481bceacd049e8c151eb8c6f6d625f57ddac79c- MD5
82dbe82dadf53d74f189b71932713ee5- Filename
- bot_x86_64.elf
- File type
- elf
- MIME
- application/x-elf
- File size
- 4943872
- Filename variants
- 3 reported
- TLSH
T101362A43F85091A5C1AEE230C6659293BA707C895F3023D36F50FBB92B76BD4AE79314- SSDEEP
49152:b6asrb/TzvO90dL3BmAFd4A64nsfJjHgT5T/qR7T8wR6JyKmDVmis6ih/9s62P+H:rSDqj5FCy6AEz
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 10. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (18%).
Confidence signal
VirusSign reports 90% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections18%
VirusSign confidence90%
Relationship context10 visible
Threat classificationkcnw
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
3shown
0%
text
24 bytes
drops
Filename
.systemd-resolve.tmp
File type
text
MIME
text/plain
Size
24
SHA1
bde9e34fb830b83ba371171b1d1a4d2cef5251f3
0%
text
70 bytes
drops
Filename
user-session.lock
File type
text
MIME
text/plain
Size
70
SHA1
514a12d1ebadeef227f811d1616a7a68521f41e3
0%
shell
16 bytes
drops
Filename
ij165115603.tmp
File type
shell
MIME
text/plain
Size
16
SHA1
318c2821d990618a90dd8d8681a0fee22519cf84
Related IPs
Network IPs associated with this indicator.
5shown
24%
high
US
communicates
CIDR
45.205.1.0/24
First seen
2026-02-22T13:32:44Z
Last seen
2026-11-08T22:15:26Z
0%
GB
communicates
CIDR
185.125.188.0/22
Network
185.125.188.0-185.125.191.255
First seen
2023-12-12T04:33:57Z
Last seen
2026-11-12T04:34:11Z
0%
GB
communicates
CIDR
185.125.188.0/22
Network
185.125.188.0-185.125.191.255
First seen
2023-10-01T07:36:54Z
Last seen
2026-11-12T04:34:11Z
5%
low
AU
communicates
CIDR
1.1.1.0/24
Network
1.1.1.0-1.1.1.255
First seen
2023-09-30T04:00:09Z
Last seen
2026-11-12T04:40:18Z
0%
GB
communicates
CIDR
185.125.188.0/22
Network
185.125.188.0-185.125.191.255
First seen
2023-09-30T18:03:12Z
Last seen
2026-11-12T04:34:11Z
Related domains
Domains associated with this indicator.
2shown
15%
medium
.top
communicates
Root
btwpayme.top
TLD
top
Subdomain
x
First seen
2026-10-19T13:00:49Z
Last seen
2026-11-08T22:15:28Z
0%
.io
communicates
Root
snapcraft.io
TLD
io
Subdomain
api
First seen
2023-10-01T01:10:27Z
Last seen
2026-11-12T04:39:32Z
Analysis details
Severity: hightrojanself-deletedebug-check64bitelf
Freshness: Fresh · Last seen 3 days ago.
- Detection rate
- 18%
- Threat type
- trojan
- Family
- kcnw
- Confidence
- 90%
- confidence
- 90 · VirusSign confidence; engine detections are reported separately.
Overview
- SHA256
f24237f81ca6e2c09ede489119e64cd2a18f0b6c269971990a223f2f2dc00ff7- SHA1
7481bceacd049e8c151eb8c6f6d625f57ddac79c- MD5
82dbe82dadf53d74f189b71932713ee5- Filename
- bot_x86_64.elf
- File type
- elf
- MIME
- application/x-elf
- File size
- 4943872
- TLSH
T101362A43F85091A5C1AEE230C6659293BA707C895F3023D36F50FBB92B76BD4AE79314- SSDEEP
49152:b6asrb/TzvO90dL3BmAFd4A64nsfJjHgT5T/qR7T8wR6JyKmDVmis6ih/9s62P+H:rSDqj5FCy6AEz- First seen
- 2026-11-08T17:37:50Z
- Last seen
- 2026-11-08T21:46:11Z
- Filename variants
- 3 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 10. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (18%).
Confidence signal
VirusSign reports 90% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family kcnw.
Relationship context
10 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
11 timestamped observations are arranged from 2015-07-16 to 2026-11-08. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family kcnw.
Last seen 3 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- bot_x86_64.elf
- File type
- elf
- MIME
- application/x-elf
- Size
- 4943872
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
- All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.
- Classification label
- Connects to IPs without corresponding DNS lookups
- Creates hidden files and/or directories
5 shown
View MITRE ATT&CK details · 5 shown
- T1564 — Creates hidden files without content (potentially used as a mutex)Tactics: TA0005
- T1564.001 — Creates hidden files, links and/or directoriesTactics: TA0005
- T1070.004 — Deletes files from diskTactics: TA0005
- T1064 — Executes commands using a shell command-line interpreterTactics: TA0002 · TA0005
- T1543.002 — Executes the "systemctl" command used for controlling the systemd system and service managerTactics: TA0003 · TA0004
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- Defense EvasionObjectives: OB0006
- C0047 — Delete FileObjectives: OC0001
- File SystemObjectives: OC0001
- C0002 — HTTP CommunicationObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5
TCP, UDPports 443, 53, 80
- 5 outbound connections observed
- 0 domains, 4 IPs, 0 URLs
- Common ports: 443, 53, 80
- Protocols: TCP, UDP
View details · 5 shown
- IP
- 45.205.1.122
- Port
- 443
- Protocol
- TCP
- IP
- 45.205.1.122
- Port
- 80
- Protocol
- TCP
- IP
- 1.1.1.1
- Port
- 53
- Protocol
- UDP
- IP
- 185.125.188.58
- Port
- 443
- Protocol
- TCP
- IP
- 185.125.188.55
- Port
- 443
- Protocol
- TCP
DNS request activity2
A5+ response IPs
- 2 DNS requests observed
- 2 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- x.btwpayme.top
- Query
- api.snapcraft.io
- Type
- A
- Answers
- 185.125.188.58, 185.125.188.59, 185.125.188.55, 185.125.188.60, 185.125.188.57, 185.125.188.54
- Response
- NOERROR
C2 candidates3
TCP, DNSports 443, 53, 80
- 3 C2 candidate communications
- 1 domains, 1 IPs
- Common ports: 443, 53, 80
- Protocols: TCP, DNS
View details · 3 shown
- Domain
- x.btwpayme.top
- Port
- 53
- Protocol
- DNS
- IP
- 45.205.1.122
- Port
- 443
- Protocol
- TCP
- IP
- 45.205.1.122
- Port
- 80
- Protocol
- TCP